fix(infra): PR #115 round 4 — fix TLS detection + remove duplicate probe

Round 3 had:
1. rc captured from wrong command (tr always exits 0)
2. Every probe issued TWICE (26 invocations instead of 13)
3. TLS branch unreachable

Round 4 fixes:
- Restructure probe_http to ONE invocation that captures both output
  and status: out=$(...); rc=$?
- Delete the duplicated block
- Fix retry classification: don't overwrite kind if already set (e.g., tls)
- Add test 7b: TLS error (000 + exit 60) → kind is tls
- Update header output shape to include (<kind>) suffix

Test: 22 passed / 0 failed (bash scripts/test_infra_monitoring.sh)

scripts/test_infra_monitoring.sh

@@ -135,8 +135,10 @@ assert "Port 9405 (historical) NOT in script source" \
     '! grep -q "9405" "$SCRIPT"'
 
 # ── 7. Failure-line content includes non-empty kind ────────────────────────
-# Stub curl to return 500 (unexpected status) and verify failure line has (<kind>)
 TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# Test 7a: Unexpected status (500) → kind should be unexpected:500
 cat > "$TMP_DIR/curl" << 'EOF'
 #!/bin/bash
 # Stub: return 500 for Grafana port, 200 otherwise
@@ -150,20 +152,49 @@ echo "200"
 exit 0
 EOF
 chmod +x "$TMP_DIR/curl"
-# Run script with stubbed curl and capture output
 OUT=$(PATH="$TMP_DIR:$PATH" bash "$SCRIPT" 2>&1)
-# Find the Grafana failure line and verify it has a non-empty kind
 GRAFANA_FAIL=$(echo "$OUT" | grep "Grafana: probe-failed")
-assert "Grafana failure line exists" \
+assert "Grafana failure line exists (unexpected status)" \
     '[[ -n "$GRAFANA_FAIL" ]]' 
-
-# Extract the kind from the failure line (should be <unexpected:500>)
 KIND=$(echo "$GRAFANA_FAIL" | grep -oP '\(<[^>]+>\)' | tr -d '()<>')
-assert "Grafana failure kind is non-empty" \
+assert "Grafana failure kind is non-empty (unexpected status)" \
     '[[ -n "$KIND" ]]' 
 
-# Cleanup
-rm -rf "$TMP_DIR"
+# Test 7b: TLS error (000 + exit 60) → kind should be tls
+cat > "$TMP_DIR/curl" << 'EOF'
+#!/bin/bash
+# Stub: return 000 and exit 60 for Grafana port (TLS error) on ALL invocations
+for arg in "$@"; do
+    if [[ "$arg" == *":3001"* ]]; then
+        echo "000"
+        exit 60
+    fi
+done
+echo "200"
+exit 0
+EOF
+chmod +x "$TMP_DIR/curl"
+# Also stub ssh to return 000 + exit 60 for the retry
+cat > "$TMP_DIR/ssh" << 'EOF'
+#!/bin/bash
+for arg in "$@"; do
+    if [[ "$arg" == curl* ]]; then
+        echo "000"
+        exit 60
+    fi
+done
+echo "200"
+exit 0
+EOF
+chmod +x "$TMP_DIR/ssh"
+export PATH="$TMP_DIR:$PATH"
+OUT=$(bash "$SCRIPT" 2>&1)
+GRAFANA_FAIL=$(echo "$OUT" | grep "Grafana: probe-failed")
+assert "Grafana failure line exists (TLS error)" \
+    '[[ -n "$GRAFANA_FAIL" ]]' 
+KIND=$(echo "$GRAFANA_FAIL" | grep -oP '\(<[^>]+>\)' | tr -d '()<>')
+assert "Grafana failure kind is tls" \
+    '[[ "$KIND" == "tls" ]]'
 
 # ── Summary ─────────────────────────────────────────────────────────────────
 echo ""